Stop Using Tailscale. Use Open Source Instead

Tailscale is excellent software, but there are legitimate reasons to self-host your coordination server:

• Data sovereignty — your network topology and device metadata stays on your infrastructure, not Tailscale's servers
• Vendor independence — no risk of pricing changes, policy shifts, or service discontinuation
• Compliance — some organizations require that all control-plane infrastructure be self-hosted
• Learning — understanding how mesh VPN coordination works under the hood

Traditional VPNs use a hub-and-spoke model: all traffic routes through a central server. This adds latency and creates a single point of failure. Mesh VPNs are different — every node connects directly to every other node using peer-to-peer WireGuard tunnels.

• WireGuard — the underlying encryption protocol. Fast, modern, built into the Linux kernel. Handles the actual encrypted tunnels.
• Coordination server — distributes public keys and endpoints so nodes can find each other. This is what Tailscale (and Headscale) provides.
• DERP relays — fallback relay servers for when direct peer-to-peer connections can't be established (strict NATs, firewalls).

The key insight: Tailscale/Headscale don't carry your traffic. They only coordinate the mesh. Actual data flows directly between your nodes over WireGuard.

Headscale runs on a single server that acts as your coordination point. Installation can be done via package manager or Docker:

The configuration file (/etc/headscale/config.yaml) defines your server URL, database backend (SQLite for small setups), IP prefix ranges, and DNS settings. Most defaults are sensible — you mainly need to set the server_url to your domain.

DERP (Designated Encrypted Relay for Packets) is a fallback relay for when two nodes can't establish a direct WireGuard connection — typically due to restrictive NATs or corporate firewalls. Tailscale operates global DERP servers; with Headscale, you can either use Tailscale's public DERP servers or run your own.

Running your own DERP server ensures complete independence from Tailscale's infrastructure:

Configure Headscale to use your custom DERP server by defining a DERP map in the configuration. Most home and cloud networks can establish direct connections, so DERP is truly a fallback — but having it ensures 100% connectivity.

The best part about Headscale: you use the official Tailscale clients. No custom software needed. You just point them at your Headscale server instead of Tailscale's:

This works on Linux, macOS, Windows, iOS, and Android — all using the official Tailscale app. The only change is the --login-server flag pointing to your Headscale instance.

Access Control Lists (ACLs) define who can talk to whom in your mesh network. Headscale supports Tailscale's ACL policy format — a JSON/YAML file that defines fine-grained network access rules:

• Groups — organize users into logical groups (devs, admins, contractors)
• Tags — label machines by role (server, database, monitoring)
• Granular ports — restrict access to specific ports, not just hosts
• Default deny — if no ACL rule matches, traffic is blocked

Headscale isn't for everyone. If you want zero operational overhead, Tailscale's managed service is still excellent. But if you value data sovereignty, need compliance guarantees, or simply enjoy self-hosting — Headscale gives you the same mesh VPN experience with full control.

• Use Tailscale if: You want managed simplicity, don't mind the control plane being external, and value their UI/admin console
• Use Headscale if: You need data sovereignty, self-hosting is a requirement, or you want to learn the internals
• Both use: The same WireGuard tunnels, the same Tailscale clients, the same mesh networking model